File and Path Handling

Every one of the 8 is a mark on the map. Named now: 1 to 8, most at risk first.

1. An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x befor…CVE-2022-47951Openstack · CVSS 5.7 · 1.1% likely

   CWE-22

2. An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into return…CVE-2022-47950Openstack · CVSS 6.5 · 1.0% likely

   CWE-552

3. In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK fl…CVE-2024-40767Openstack · CVSS 6.5 · 0.9% likely

   CWE-552

4. An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supply…CVE-2024-32498Openstack · CVSS 6.5 · 0.8% likely

   CWE-552

5. OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.CVE-2026-48681OpenStack · CVSS 5.9 · 0.6% likely

   CWE-23

6. A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attack…CVE-2022-3146Openstack · 0.2% likely

   CWE-22

7. A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attack…CVE-2022-3101Openstack · 0.2% likely

   CWE-22

8. OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via the API). A malicious project assigned as…CVE-2025-44021OpenStack · CVSS 2.8 · 0.2% likely

   CWE-22

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.